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Abstract 

Techniques of watermarking/fingerprinting concern the embedding of identification 
data into a piece of software, allowing for later claims of authorship/ownership and there- 
fore discouraging piracy. Graph-based software watermarking schemes comprise an encod- 
ing algorithm, which translates a given number (the identifier, usually a positive integer) 
onto some appropriately tailored graph (the watermark), and a decoding algorithm, which 
extracts the original identifier from a given watermark. Collberg, Kobourov, Carter and 
Thomborson (Error-correcting graphs for software watermarking, WG'03) introduced one 
such scheme, meant for software watermarking, in which an integer key was encoded onto 
a reducible permutation graph. A number of interesting ideas have further improved the 
original scheme, including the formulation of a particularly promising linear-time codec 
by Chroni and Nikolopoulos. We extend the work of these authors in various aspects. 
First, we characterize the class of graphs constituting the image of Chroni and Nikolopou- 
los's encoding function. Furthermore, we formulate a novel, linear-time watermark-to-key 
decoding algorithm which detects and recovers from ill-intentioned removals of /c < 2 
edges. Finally, our results also include the detection of /c < 5 edge modifications (inser- 
tions/deletions) in polynomial time, and a proof that such bound is tight, so the resilience 
of the considered watermarking scheme is fully determined. Our proof that graphs of a 
well characterized class can detect — and recover from — bounded-magnitude distortive at- 
tacks reinforces the interest in regarding those graphs as possible watermarking solutions 
to numerous applications. 
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1 Introduction 



Preventing the theft of intellectual property has been an everlasting, highly sought after goal. 
For ages have books been photocopied, pictures counterfeit, recordings unscrupulously shared. 
More recently, the criminal reproduction of software known as software piracy has become a 
big concern, and the struggle between the opposing forces of pirates and security engineers has 
been increasingly fierce. 

Watermarking/fingerprinting an object is the act of embedding an identifier of author- 
ship/ownership within that object, so to discourage illegal copying. Different approaches to 
software watermarking have been devised to date, still none of them was ever proved to be suf- 
ficiently resilient, let alone immune, to the numerous forms of program transformation attacks. 
Naturally, a lot of research towards strengthening such methods has been endeavored. The 
pioneering graph-based watermarking algorithm formulated by Davidson and Myrhvold in- 
spired the first watermarking algorithm where a positive integer key meant for identification was 
encoded as a special digraph to be disguised into a method's flow graph, by Venkatesan, Vazirani 
and Sinha [16]. Other graph-based software watermarking schemes include [8|IT0 | [Tl ] [T5] . 

In this paper, we consider the ingenious graph-based software watermarking scheme in- 
troduced by CoUberg, Kobourov, Carter and Thomborson jS], and afterwards developed and 
improved upon by Chroni and Nikolopoulos [3]. These latter authors proposed a linear-time 
codec where the watermarks are instances of the reducible permutation graphs introduced in [9]. 
(We refer the reader to further papers by the same authors, such as [HElllHT].) Though the 
mechanics of encoding- decoding the watermark is well described in [3j, the class of such special 
graphs has not been fully characterized. Moreover, not much was known thus far about the 
resilience of Chroni and Nikolopoulos's graphs to malicious attacks, even though their ability to 
withstand attacks in the form of a single edge modification has been suggested without proofs. 
A thorough scrutiny of the structural properties of the aforementioned graph class allowed us 
to give it a formal characterization, as well as to introduce a simple, linear-time decoding al- 
gorithm that retrieves the correct, untampered with encoded key even when k < 2 edges of 
the watermark are missing. Such algorithm allows for the determination of the exact resilience 
level of the considered codec against distortive attacks. 

Additionally, we present computational results with a twofold goal: to corroborate the 
excellent performance of Chroni and Nikolopoulos's scheme using our novel decoding algorithm, 
and to evidence that, by using the exact, unmodified encoding algorithm given in [3], the number 
of pairs of watermarks whose edge set differ in no more than k elements, for any fixed A; > 3, 
grows with the size of the key. 

The paper is organized as follows. In Section [2l we recall the codec from [3], formulating and 
proving a number of properties of the employed structures. In Section [3|, we characterize the 
class of canonical reducible permutation graphs. In Section HI we tackle the edge-removal attack 
model, proving that, for keys of size n > 2, it is always possible to identify and recover from 
attacks that remove k < 2 edges. Finally, in Section 0, we formulate a linear-time algorithm 
that reconstructs the original digraph, in case k < 2 edges are missing, recovering the encoded 
key thereafter. As a corollary of the results hitherto presented, we fully determine the resilience 
of the considered watermarking scheme. Computational results are then presented in Section [6l 
and Section [7| concludes the paper with our final remarks. 
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2 The watermark by Chroni and Nikolopoulos 



We start by briefly recalling the software watermarking codec described in [3]. 

Let u he a positive integer key, with n the size of the binary representation B of u. Let 
also riQ and rii be the number of O's and I's, respectively, in B, and let /o be the index0 of the 
leftmost in B. The extended binary B* is obtained by concatenating n digits 1, followed by 
the one's complemenlH of B and by a single digit 0. We let n* = 2n + 1 denote the size of B*, 
and we define Zq = i = 1, . . . ,ni + 1, as the ascending sequence of indexes of O's in B*, 
and Zi = {zD, i = 1, . . . ,n + no, as the ascending sequence of indexes of I's in _B*. 

Let S" be a sequence. We denote by the sequence formed by the elements of 5" in backward 
order. If S" = (sj), z = 1, . . . , t, is a sequence of size t, and there is an integer k <t such that the 
subsequence consisting of the elements of S with indexes less than or equal to k is ascending, 
and the subsequence consisting of the elements of S with indexes greater than or equal to k is 
descending, then we say 5* is bitonic. If all t elements of a sequence S are distinct and belong 
to {1, ... , t}, then S' is a permutation. If S' is a permutation of size t, and, for all 1 < z < t, the 
equality i = s^. holds, then we say S is self-inverting. In this case, the unordered pair {i, Si) is 
called a 2-cycle of S, if i Si, and a 1-cycle of S*, if z = s,. If 5*1, 5*2 are sequences, we denote 
by S'illS'2 the sequence formed by the elements of 5*1 followed by the elements of S2. 



Back to Chroni and Nikolopoulos's codec, the bitonic permutation Ph = Zq\\Z^ = [bi), 
i = 1, . . . , n*, is obtained by appending to Zq the elements of Zi in backward order, and, finally, 
the self-inverting permutation Pg is obtained from Ph as follows: for i = 1, . . . ,n*, index 6j in Pg 
is assigned to element s^. = bn*-i+i, and index bn*-i+i in Pg is assigned to element Sfe^,_^^^ = 6j. 
In other words, the 2-cycles of Pg correspond to the n unordered pairs of distinct elements 
of Ph that are equidistant from the extremes of Pb, namely the pairs (p, g) = (fej, for 
i = 1, . . . ,n. Since the central index i = n + 1 of Pb is the solution of equation n* — i + 1 = i, 
element bn+i — and no other — will constitute a 1-cycle in Pg. We refer to such element of Pg 
as its fixed element, and we let / denote it. 

The watermark generated by the codec from [3] belongs to the class of reducible permutation 
graphs first defined in 0. It is a directed graph G whose vertex set is {0, 1, . . . , 2?7, + 2}, and 
whose edge set contains in + 3 edges, to wit: a path edge {u,u — 1) for -u = 1, . . . , 2n + 2, 
constituting a Hamiltonian path that will be unique in G, and a tree edge from u to q{u), for 
u = 1, . . . ,n*, where q{u) is defined as the vertex v > u with the greatest index in Pg to the left 
of u, if such V exists, or 2n + 2 otherwis^. A graph so obtained is called a canonical reducible 
permutation graph. 



Let us glance at an example. For 00 = 43, we have B = 101011, n = 6, rio = 2, rii = 4, /o = 2, 
B* = 1111110101000, n* = 13, Zq = (7, 9, 11, 12, 13), Zi = (1, 2, 3, 4, 5, 6, 8, 10), Pb = (7, 9, 11, 
12,13,10,8,6,5,4,3,2,1), Pg = (7,9,11,12,13,10,1,8,2,6,3,4,5) and / = 8. The generated 
watermark G will have, along with the path edges in Hamiltonian path 14 —t- 13 —t- 0, 
also the tree edges (1, 10), (2, 8), (3, 6), (4, 6), (5, 6), (6, 8), (7, 14), (8, 10), (9, 14), (10, 13), (11, 14), 
(12, 14) and (13, 14), as illustrated in Figure [H 



We now state a number of properties concerning canonical reducible permutation graphs 
and the special permutations they are associated to. These properties, whose proofs are given 
in the Appendix, set the basis for the characterization given in Section [3] and for the recovering 

^The index of the first element in all sequences considered in the text is 1. 

^ The one's complement of a binary R is obtained by swapping all O's in R for I's and vice- versa. 

^ The rationale behind the name tree edge is the fact that such edges induce a spanning tree of G \ {0}. 
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Figure 1: Watermark for key w = 43. 



procedures described in Section SJ 

For all properties stated below, let G be the canonical reducible permutation graph associ- 
ated to a key u of size n, and let Pb and Pg be, respectively, the bitonic and the self-inverting 
permutations dealt with during the construction of G. 

Property 1 For 1 < i < n, element bn+i+i in Pf, is equal n — i + 1, that is, the n rightmost 
elements in Pf, are 1,2, ... ,n when read from right to left. 

Property 2 The elements whose indexes are 1,2, ... ,n in Pg are all greater than n. 

Property 3 The fixed element f satisfies f = n + fo, unless the key u is equal to 2^ — 1 for 
some integer k, whereupon f = n* = 2n + 1. 

Property 4 In self-inverting permutation Pg, elements indexed 1, 2, ...,/ — n — 1 are respec- 
tively equal to n-\-l,n-\-2, . . . , f — 1, and elements indexed n + l,n-\-2, . . . , f — 1 are respectively 
equal to 1,2, f — n — 1. 

Property 5 The first element in Pg is Si = n + 1, and the central element %n Pg IS Sii-\-i — 1- 

Property 6 // / 7^ n* , then the index of element n* in Pg is equal to ni + 1, and vice-versa. 
If f = 1^* ; then the index of element n* in Pg is also n* . 

Property 7 The subsequence of Pg consisting of elements indexed 1, 2, . . . , n + 1 is bitonic. 

Property 8 For u ^ 2n -\- 1, (m, 2n + 2) is a tree edge of watermark G if, and only if,u — n 
is the index of a digit 1 in the binary representation B of the key uo represented by G. 

Property 9 // {u, k) is a tree edge of watermark G, with k ^2n + 2, then 
(i) element k precedes u in Pg; and 

(a) if V is located somewhere between k and u in Pg, then v < u. 

3 Canonical reducible permutation graphs 

This section is devoted to the characterization of the class of canonical reducible permutation 
graphs. After describing some terminology, we define the class using purely graph-theoretical 
predicates, then we prove it corresponds exactly to the set of all watermark instances possibly 
produced by Chroni and Nikolopoulos's encoding algorithm [3J. Finally, we characterize it in a 
way that suits the design of a new, resilient, linear-time decoding algorithm. 
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Given a graph G, we let V{G) and E{G) denote, as usual, the vertex set and edge set of 
G, respectively. Also, we let Nq{v) and N^{v) denote, respectively, the set of out-neighbors 
and in- neighbors of vertex v G V{G). A reducible flow graph [T31[I1] is a directed graph G with 
source s G V{G), such that, for each cycle C of G, every directed path from s to C reaches C 
at a same vertex. It is well known that a reducible flow graph has at most one Hamiltonian 
cycle. 

Definition 10 A self-labeling reducible flow graph relative to n > 1 is a directed graph G such 
that 

(i) \V{G)\ =2n + 3; 

(ii) G presents exactly one directed Hamiltonian path, hence there is a unique labeling function 
a : V{G) — )■ {0, 1, . . . , 2n + 2} oj the vertices of G such that the order of the labels along 
the Hamiltonian path is precisely 2n + 2,2n + 1, . . . , 0; 

(Hi) considering the labeling a as in the previous item, Ai"^(0) = 0, Nq{0) = {1}, 
iV+(2n + 2) = {2n + 1}, liV^ (2n + 2)| > 2, and, for all v E V{G) \ {0,2n + 2}, 
Nq{v) = {v — l,w}, for some w > v. 

From now on, without loss of generality, we shall take a for granted and assume the vertex 
set of any self-labeling reducible flow graph G is the very set V{G) = {0, 1, . . . , 2n + 2}, yielding 
the unique Hamiltonian path 2n -|- 2, 2n + 1, . . . , in gE 

Let G be a self-labeling reducible flow graph and H its unique Hamiltonian path. We 
define a tree T with vertex set V{T) = V{G) \ {0}, and edge set E(T) comprising all edges 
in E{G) \ E{H) deprived of their orientation. We call T the representative tree of G, and we 
regard it as a rooted tree whose root is 2n + 2, and where the children of each v G V{T), 
denoted Nt{v), are exactly the in-neighbors of f in G \ E{H). In addition, we regard T as an 
ordered tree, that is, for each v G V{T), the children of v are always considered according to an 
ascending order of their labels. Finally, for f G T, we denote by N^{v) the set of descendants 
of V in T. Figure [2] depicts two representative trees. 

Observation 11 The representative tree T of a self-labeling reducible flow graph G satisfies 
the max-heap property, that is, if vertex u is a child of vertex v in T , then v > u. 

Proof. Direct from the way T is rooted and from property (iii) in the definition of self-labeling 
reducible flow graphs, whereby the in-neighbors of w in G\E{H) comprise only vertices v < w. 
We convey the idea that a representative tree T satisfies the max-heap property by saying that 
T is a descending, ordered, rooted tree. □ 

Definition 12 Let S = {si),i = 1, . . . ,2n + 1, be a self-inverting permutation. We say S is 
canonical if: 

(i) there is exactly one 1-cycle in S; 

(ii) each 2-cycle {si, Sj) of S satisfies I <i <n, for Si > sj; 

By doing so, we may simply compare two vertices, e.g. v > u (or v greater than u, in full writing), whereas 
we would otherwise need to compare their images under a, e.g. a{v) > (j(u). 
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(in) si, . . . , Sn+i is a bitonic subsequence of S starting at si = n + 1 and ending at Sn+i — 1- 

Lemma 13 In any canonical self-inverting permutation of {1, . . . ,2n-\- 1}, the fixed element f 
satisfies / e [n + 2, 2n + 1]. 

Proof. By property (ii) of canonical self-inverting permutations, each 2-cycle of S must contain 
at least one element whose index i satisfies 1 < i < n. From property (i), and given the size 
of S, it follows that the number of 2-cycles in S is n, hence, by the pigeonhole principle, each 
and every 2-cycle in S contains exactly one such element Si with 1 < i < n. But this means 
the other element in each 2-cycle, namely sj, satisfies sj e [n -|- 1, 2n -|- 1]. Since there are 
n + 1 values in that range and only n such elements Sj, there must be exactly one element 
Sk E [n-\- 1, 2n + 1] which is not part of a 2-cycle, and therefore Sk — f ■ Now, by property (iii), 
n -|- 1 = Si, hence / 7^ n -|- 1, and the lemma follows. □ 

Let T be some representative tree, therefore a descending, ordered, rooted tree. The preorder 
traversal P of T is a sequence of its vertices that is recursively defined as follows. If T is empty, 
P is also empty. Otherwise, P starts at the root r of T, followed by the preorder traversal of 
the subtree whose root is the first (i.e. smallest) child of r, followed by the preorder traversal 
of the subtree whose root is the second smallest child of r, and so on. The last (rightmost) 
element of P is referred to as the rightmost element of T as well. 

Lemma 14 The preorder traversal of a representative tree T is unique. Conversely, a repre- 
sentative tree T is uniquely determined by its preorder traversal. 

Proof We use induction on \V{T)\. If |l^(T)| < 1, the lemma holds trivially. Let \V{T)\ > 1, 
and let Vk be the uniquely defined leaf of T for which the path Vi, . . . ,Vk from the root Vi of T 
to Vk has the property that each f j, for 1 < i < A;, is the greatest vertex among the children of 
V — 1. By the induction hypothesis, the preorder traversal P' oiT\ {vk} is unique. Because 
is necessarily the rightmost vertex of T, the preorder traversal P of T is uniquely determined 
as P'\\vk. 

Conversely, let P be a preorder traversal of some representative tree T. If |P| < 1, there is 
nothing to prove. Otherwise, suppose the lemma holds for preorder traversals of size < /c, and 
consider |P| = k. Let be the rightmost element of P. Clearly, must be a leaf of T, and 
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the rightmost (i.e. greatest) vertex among the children of its parent. Now define P' = P — Vk 
(i.e. P without its rightmost element Vk)- By induction, there is a unique tree T' whose preorder 
traversal is P' . Let Vk-i be the rightmost element of P' . We obtain T from T', by making 
the rightmost child of the smallest ancestor Vj of v^-i satisfying Vj > ffc, so P is clearly the 
preorder traversal of T. Since no other parent for Vk would be possible without breaking the 
ascending order of siblings in a representative tree, T is uniquely defined by P. □ 

The first element of the preorder traversal P of a tree T is always its root. If we remove the 
first element of P, the remaining sequence is said to be the root-free preorder traversal of T. 
We can now define the class of canonical reducible permutation graphs. 

Definition 15 A canonical reducible permutation graph G is a self-labeling reducible graph such 
that the root-free preorder traversal of the representative tree of G is a canonical self-inverting 
permutation. 

Lemma 16 If G is a watermark instance produced by Chroni and Nikolopoulos's encoding 
algorithm f^, then G is a canonical reducible permutation graph. 

Proof: Recall, from Section |2l that the watermark (i.e. the canonical reducible permutation 
graph) G associated to key u, whose binary representation B has size n, is constructed with 
vertex set V{G) = {0, . . . , 2n + 2} and an edge set E{G) which can be partitioned into path 
edges and tree edges in such a way that all conditions in the definition of self-labeling reducible 
graphs are satisfied, as can be easily checked. Now, by Property [9] of canonical reducible 
permutation graphs, the tree edges of G constitute a representative tree T of G whose root-free 
preorder traversal is precisely the self-inverting permutation Pg determined by the encoding 
algorithm from [3] as a function of B. Consequently, what is left to prove is that P^ = P is 
canonical. The first condition to P being canonical (the uniqueness of the 1-cycle in P) is 
met by construction, also asserted by Property [3] of reducible permutation graphs; the second 
condition is given by Property [21 and, finally. Properties |5] and [7] guarantee the third and final 
condition, so P is indeed canonical. □ 

Lemma 17 If G is a canonical reducible permutation graph, then G is the watermark produced 
by Chroni and Nikolopoulos's encoding algorithm for some integer key u. 

Proof. Let G be a canonical reducible permutation graph, and T its representative tree. 
By Lemma [TU T is uniquely defined by its preorder traversal P. We show that P corre- 
sponds to the self-inverting permutation Pg generated by the encoding algorithm of [3] (please 
refer to Section [2] for details) when computing the watermark for some integer key u. By defi- 
nition, P = {si),i = 1, . . . , 2n + 1, is a canonical self-inverting permutation presenting a single 
1-cycle / and a number n of 2-cycles {p,q). Those 2-cycles {p,q) define exactly one bitonic 
permutation P^ = (bj), j = 1, . . . ,2n -\- 1 satisfying 

(i) bn+i = /; 

(ii) for all j G {1, . . . , n}, bj = p if, and only if, 62n+i-j = and 

(iii) Property [T]of canonical reducible permutation graphs, concerning the bitonic permutation 
employed by the encoding algorithm. 
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Such bitonic permutation Ph can be regarded as Zo\\Zi by assigning to Zq the prefix of Pb 
comprising its maximal ascending subsequence, and now the indexes of O's and I's in the 
extended binary B* are totally determined. We proceed by extracting the binary B that is the 
one's complement of the subsequence of B* with digits from the (n+l)-th to the (2?T,)-th position 
in B*. Since B is but the binary representation of a well determined positive integer, such is 
the positive integer u whose image under the encoding function of Chroni and Nikolopoulos is 
isomorphic to G. □ 

We now seek a suitable characterization of canonical reducible permutation graphs solely 
in terms of their representative trees. Such a characterization will prove useful, since its strong 
algorithmic fiavor will allow for a new decoding algorithm that is not only resilient to < 2 
edge removals but also simpler, while still running in linear time. 

Let T be the representative tree of some canonical reducible permutation graph G, and 
P a canonical self-inverting permutation corresponding to the root-free preorder traversal 
of T. We refer to the fixed element / of P also as the fixed element (or vertex) of both G 
and T. Similarly, the 2-cyclic elements of P correspond to cyclic elements (or vertices) of both 
G and T. The concepts we describe next will be employed in the characterization of canonical 
reducible permutation graphs. 

A vertex v G V{T) \ {2n + 2} is considered large when n < v <2n + l; otherwise, v < n and 
V is dubbed as small. Denote hj X,Y, respectively, the subsets of large and small vertices in T, 
so |X| = n+1 and \Y\ = n. By Lemma [T^ / G X. We then define Xc = X\{f} = {xi, . . . , x„} 
as the set of large cyclic vertices in T. 

We say that T is a type-1 tree — please see Figure [3](a) — when 

(i) n + 1, n + 2, . . . , 2n + 1 are children of the root 2n + 2 in T; and 

(ii) 1,2, ... ,n are children of 2n. 

Elseways, we say that T is a type-2 tree relative to / — please see Figure Mjo) — when 

(i) n + 1 = Xi < X2 < . . . < X£ = 2n + 1 are the children of 2n + 2, for some £ G [2, ri — 1]; 

(ii) Xi > and Xj is the parent of Xj+i, for all i E [i,n — 1]; 

(iii) 1, 2, ...,/ — n — 1 are children of Xn] 

(iv) Xi = n + i, for 1 < i < f — n — 1] 

(v) / is a child of Xg, for some q G [£, n] satisfying Xg+i < / whenever q < n; and 

(vi) N^{f) = {f — n, f — n + 1, . . . ,n} and yi G N^{f) has index x^. — / + 1 in the preorder 
traversal of N^[f]. 

Lemma 18 // yr is the rightmost vertex of a type-2 representative tree T relative to some 
f ^ 2n + 1, then yr = i. 

Proof. By the definition of a type-2 representative tree, the only non-leaf child of the root 
2n + 2 of T is its rightmost child Xi, therefore each child Xi of 2n + 2, 1 < i < i, appears 
precisely at the i-th position in the root-free preorder traversal P of T. Since, by definition, P 
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Figure 3: (a) A type-1 representative tree, (b) A type-2 representative tree. 



is self-inverting, and Ur is the last, (2n + l)-tli element of P, it follows that Ur must be equal to 
the index of 2n + 1 = in P, that is, Ur = L □ 

The following theorem characterizes canonical reducible permutation graphs in terms of the 
above defined trees. 

Theorem 19 A digraph G is a canonical reducible permutation graph if, and only if, G is a 
self-labeling reducible graph and 

(i) the fixed element of G is 2n + 1 and G has a type-1 representative tree; or 

(a) the fixed element of G belongs to [n + 2, 2n] and G has a type-2 representative tree. 

Proof. Let G be a canonical reducible permutation graph and T its representative tree. By 
definition, G is a self-labeling reducible graph. Let P = si, . . . , S2n+i be the root-free preorder 
traversal of T, hence a canonical self-inverting permutation, also by definition. This means, 
among other things, that P has a unique fixed element /, and that P' = Si, . . . , Sn+i is a 
bitonic subsequence of P. Since T is descending, it follows that the prefix A of P' constituting 
its maximal ascending subsequence must comprise solely vertices that are children of the root 
2n + 2, the rightmost of which certainly being 2n + 1. 

First, let / = 2n -\- 1. Since / constitutes a 1-cycle of P, / must occupy the rightmost, 
(2n -|- l)-th position in P, hence / is a leaf of T. Furthermore, by Property H] of canonical 
reducible permutation graphs, it follows that P' consists of elements n + l,n + 2, . . . , 2n, 1, 
hence A = n -\- l,n 2, . . . , 2n, and these vertices are therefore children of 2n + 2 in T. Now, 
again by Property IH elements 1, . . . , n appear, in this order, to the right of A in P. Considering 
that P is a preorder traversal and a representative tree satisfies the max-heap property, we 
conclude that vertices 1, . . . , n can only be children of 2n, hence T is a type-1 tree, as required. 

Next, suppose f < 2n -\- 1. By Lemma [TS| it follows that / G [n -\-2, 2n]. We already know 
that the children of 2n + 2 are the vertices of A. Let D be the subset formed by the remaining 
vertices of P'. Clearly, the vertices of D must appear in descending order. Since T satisfies the 
max-heap property and P is a preorder traversal of T, it follows that the largest vertex of D is 
a child of 2n+ 1, and subsequently each vertex in D is the parent in T of the vertex placed to its 
left along the sequence D. Again, because T satisfies the max-heap property, / G [2n + 2, 2n] 
must be the child of the smallest vertex Xg E D U {2n -\- 1} satisfying Xg > f. Let us again 
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examine the ascending subsequence A. We know that the first vertex of A is n + 1. Suppose 
the leading k vertices of A are n + 1, n + 2, . . . , n^, for some k. Because P is self-inverting, it 
follows that the vertices 1,2, ... ,k must be the children of the last (i.e. smallest) vertex of D, 
and k = f — n — lhj Property IH It remains solely to describe how the remaining small vertices, 
namely f — n, f — n + 1, . . . ,n, are placed in T. Since they appear after / in P, it can only 
be that this subset comprises exactly the descendants N^{f) of / in T. Each of the vertices 
y G N^if) constitute a 2-cycle with some vertex x belonging to the bitonic subsequence P', 
hence the index oi y in P is exactly x, and all the conditions for a type-2 tree have thus been 
verified. 

Conversely, let G be a self- labeling reducible graph. First, suppose that (i) applies and 
let T be the corresponding type-1 representative tree. Then the root-free preorder traversal P 
of T is 

n + l,n + 2, . . . , 2n, 1,2, . . . ,n,2n + 1. 

Regarding P as a permutation of {1, . . . , 2n+l}, we observe that 2n -|- 1 is the only fixed 
vertex on it; for 1 < i < n, each element n + i oi P has index i, while i has index n + i, 
and n + l,n + 2, . . . ,2n,l form a bitonic subsequence of P. Consequently, P is a canonical 
self-inverting permutation, and G is a canonical reducible permutation graph. 

Finally, suppose (ii) applies. Let T be the corresponding type-2 representative tree relative 
to some / G [n + 2, 2rt\. The root-free preorder traversal P of T consists of 

xi,..., Xi, xi+i, ...,Xq, Xq+i, . . . , 1, 2, . . . , / - n - 1, /, P{N^{f)), 

where Xi = n + 1; xg = 2n + 1; Xi = n + i for 1 < i < f — n — 1; Xi, X2, . . . , Xn, 1 is a bitonic 
subsequence of P; and P{N^{f)) denotes the preorder traversal of the vertices of N^{f), in 
which each yi G N^{f) has index Xy- — f + 1. Observe that, foT 1 < i < f — n — 1, {n + 
constitutes a 2-cycle in P. Moreover, for f — n < i < n, vertex Xi forms a 2-cycle with 
an element yj G N^{f). All conditions have been met, thus P is a canonical self-inverting 
permutation and G is a canonical reducible permutation graph. □ 

Corollary 20 The recognition of canonical reducible permutation graphs can be achieved in 
linear time. 

Proof. Direct from Theorem [19] and from the straightforward conditions in the definitions of 
self-labeling reducible graphs, type-1 trees and type-2 trees, all of which can be easily verified 
in linear time. □ 

4 Restoring a damaged watermark 

In this section, we analyze the effects of a distortive attack against a watermark (i.e. a canonical 
reducible permutation graph) G whereby two edges €1,62 G E{G) were removed. Note that 
the unique Hamiltonian path H of G may have been destroyed by the attack. Our first task 
is therefore to identify whether ei, 62 are edges from H (path edges) or from its representative 
tree T (tree edges). Let G' = G \ {ci, 62}. 
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Procedure [Tt Reconstructing the Hamiltonian path 


vo 


^ \V ^ V [ij ) S.t. iVg,, = U| 


T/ 

Vl 


^ j„, ^ M ( n'\ o + 1 Ar+ 1 11 

■i — \V V \ \j ) s.t. l-iVg, 1 — ij- 


if 
11 


It/ I 1 -fVioTi 

1 vg 1 — i tnen 




let I'o be the unique element in Vq 




if \H{vo)\ = 2n + 3 then H ^ H{vq), return H and edge types as in Figure Hl^a) 




else if 3 G Vi such that \H{vo) \ + \H(vi) \ = 2n + 3 then 




H ^ H{vi)\\H{vo), return H and edge types as in Figures |l](b,c) 




else 




let vi,v[ G Vl be such that 




\H{vo)\ + \H{vi)\ + \H{vi,)\ = 2n + 3 and N^,{first{H{vi)) n H{vv) ^ 




H ^ H{v'^)\\H{vi)\\H{yQ), return H and edge types as in Figure |l](d) 


else 




let t>o, v'q be the elements in Vq 




if \H{vo)\ + \H{v'q)\ = 2n + 3 then 




let Vq be such that N^,{first{H{vo))) n ^ 




if if(fQ) ii(fo), return H and edge types as in Figures |l](e,f) 




else 




let v'q G Vq and fi G Vi be such that v'q G N^,{first{H{vi)) 




H ^ H{v'Q)\\H{vi)\\H{yQ), return H and edge types as in Figures |l](g,h) 



4.1 Reconstructing the Hamiltonian path 

The algorithm given in pseudocode as Procedure [1] reconstructs the Hamiltonian path H of G, 
in case ei or 62 belonged to if, and classifies each missing edge as either a path edge or a tree 
edge. The input is the damaged watermark graph G' . If f G V{G'), we denote by H{v) the 
subsequence of the Hamiltonian path of G that ends at v and starts as far as possible in G' . 
Also, we denote by first{H{y)) the first vertex of the subsequence H{y). 

The mechanics of Procedure [1] is that of simply sewing together the fc' < 3 maximal directed 
paths resulting from deletion of A; < 2 edges from the original, unique hamiltonian path of G. 
Its correctness can be inferred by simple code inspection, where the different possible scenarios 
are illustrated in Figure HI 

We discuss the possible alternatives produced by the algorithm. If the algorithm terminates 
by reporting Figure |l](a), then the original Hamiltonian path of G has been preserved by the 
attacker's action, that is, ei, 62 are both tree edges. In this case, further steps will be necessary 
to determine exactly which edges have been deleted and therefore retrieve the entire graph. If 
the algorithm terminates by reporting Figures |ll^b,c) or|ll^e,f), then one of the missing edges 
is a path edge and the other one is a tree edge. Since the Hamiltonian path of G has been 
fully recovered, we conclude that it is only necessary to further retrieve one tree edge. Finally, 
terminating by reporting Figure 111(d) or Figures ll](g,h) means that both missing edges belong 
to the Hamiltonian path of G. Since the path has been recovered, we conclude that no further 
computation is necessary, and the entire recovering algorithm can terminate at this point. 

As for the time complexity of the algorithm, note that, in general, 1 < |Vo| < 2 and 
1 < |^i| ^ 3. The latter follows from the definition of a self-labeling reducible graph and from 
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-XD >0 (e) • >C> K) >□ 

--->0 >0 (f) CF---X3 >0 >□ 

— K) >n (g) IIF--->0 >9- K) >o — >n 



^---->o — >a (h) □----xD ^ ->□ 

Figure 4: Possible scenarios for the Hamiltonian path of a damaged watermark G. Dashed 
arrows indicate missing edges. Broken arrows (with a tilde in the middle) indicate paths 
of arbitrary size, where the extremes can coincide. Squares, solid circles and hollow circles 
represent vertices whose out-degrees in G' are, respectively, 0, 1 and 2. The tree edges of G' 
are not being shown (unless those removed by the attacker, in dashed curved lines). 



the fact that two edges were removed from G. Moreover, observe that each path H{vi) can be 
computed in time \H{vi)\ easily. Consequently, the entire algorithm has complexity 0{n). 



4.2 Determining the fixed vertex 

Suppose the watermark G has been attacked, which resulted in a damaged watermark G', 
where two unknown edges are missing. Now we shall recognize the fixed vertex of the original 
watermark, given the damaged one. Getting to know the fixed vertex of G will play a crucial 
role in retrieving the missing tree edges and consequently restoring the original key w encoded 
by G. 

We describe some characterizations that lead to an efficient computation of the fixed vertex 
/ of G. Let T be the representative tree of the original watermark G. We consider the case 
where the two edges that have been removed belong to T. Denote by F the forest obtained 
from T by the removal of two edges. First, we consider the case / = 2n + 1. 

Theorem 21 .■ Let F be a forest obtained from the representative tree T by removing two 
edges, where n > 2. Then / = 2n + 1 if, and only if, 

(i) vertex 2n + l is a leaf of F; and 

(a) the n small vertices of G' are children of 2n in F, with the possible exception of at most 
two of them, in which case they must be isolated vertices. 

Proof. From Theorem [191 we know that, when / = 2r;, + 1, / is the rightmost vertex of 
T, hence a leaf of F, implying the necessity of condition (i). Again by Theorem [T9| the small 
vertices of T must immediately follow the rightmost cyclic vertex of T, namely 2n. Since two 
edges have been deleted from T, it follows that all small vertices are children of 2n in F, 
with the possible exception of at most two of them, which then became isolated vertices, so 
condition (ii) is also necessary. 

Conversely, suppose conditions (i) and (ii) hold, and assume f ^ 2n + 1. Then the second 
case covered by Theorem [19] applies for T. If / = 2n, we know from n > 2 that vertex 2n + 1 
has at least 3 children in T, making it impossible for 2n + 1 to become a leaf of F by the removal 
of only two edges, therefore contradicting condition (i). If, on the other hand, / < 2n, then. 
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Figure 5: (a-c) Conditions (i), (ii) and (iii) of Theorem [2^ respectively. 



again by Theorem [191 vertex 2n + l cannot have any small children, contradicting condition (ii). 
Therefore / > 2n, implying / = 2n + 1. □ 

Next, we characterize the case / < 2n + 1. Figure [5] helps to visualize the three conditions 
of the theorem. 

Theorem 22 .■ Let F be a forest obtained from the representative tree T of watermark G by 
removing two of its edges, and let x <2n be a large vertex ofT which is not a child of 2n + 2. 
Then x is the fixed vertex f of G if, and only if, 

(i) the large vertex x has a sibling z in F , and x > z; or 

(ii) the subset of small vertices Y' gY, Y' = {x — n,x — n + 1, . . . ,n} can be partitioned into 
at most two subsets Y(, Y^, such that 7^ F/ = Np{x) and Y^ is the vertex set of one of 
the trees which form F; or, whenever the previous conditions do not hold, 

(iii) the large vertex x is the rightmost vertex of one of the trees of F, while the rightmost 
vertices of the remaining trees are all small vertices. 

Proof: For the sufficiency of condition (i), let x be a large vertex of F, z a sibling of x in F 
and Xq their parent. By Theorem [191 the only large vertex of T which is not a child of 2n + 2 
and has some sibling z is precisely the fixed vertex /. Clearly, the removal of edges of T cannot 
create new vertices having this property. Furthermore, Xg ^ {x„, 2n + 1} implies that / has a 
unique sibling Xg+i, hence / > x^+i according to the ascending order of siblings in F, whereas 
Xq G {xn, 2n + 1} implies every sibling y of / is a small vertex, hence f > y. Consequently, 
x = f. 

Now suppose condition (ii) holds. First, assume that Y2 = 0. In this case, Y' = Y( = 
{x — n,x — n + 1, . . . ,n} = Np{x). Again, according to Theorem [191 we can locate a unique 
vertex / fulfilling this property, implying x = f. In addition, when Y2 7^ 0, we can again select 
a unique vertex /, where Np{f) U Y2 = Y'. Thus, x = f indeed. 

Finally, assume neither condition (i) nor condition (ii) hold. Because (i) is not satisfied, 
we have that either Xq ^ {xn,2n + 1}, and the edge from Xq to one of its children has been 
deleted; or Xq G {xn,2n + 1}, and the edge {xq, f) has been deleted. Additionally, since (ii) 
is not satisfied, / must have a unique child y, and the edge (/, y) has also been removed. 
Next, assume that, in such a context, condition (iii) is verified. For the sake of contra- 
diction, suppose the theorem is false, so that x ^ f . Since x 7^ 2n + 1 and x is not a 
child of 2n + 2, it follows that it must be a descending vertex, whereupon the fact that x 
is the rightmost vertex of the tree of F containing it implies that x is a leaf of F . Now 
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the latter implies that the edge {xq, x) of T has been removed, where Xq is the parent of x 
in T. Because condition (i) is not satisfied, at least one edge has been removed from T, and 
because condition (ii) is not satisfied, at least one more edge has been deleted from T. Since 
no more than two edges overall have been removed, we conclude that the assumption is false, 
and therefore, here again, x = f. 

Conversely, assume that x is the large vertex of F satisfying x = f. We prove that condi- 
tion (i) or condition (ii) holds, otherwise condition (iii) is satisfied. 

Let Xq be the parent of x = / in T. If Xq has at least two children in F, then / is larger 
than its siblings, by Theorem [111 and condition (i) holds. Alternatively, if / is not a leaf of F, 
then the set Y' = {x — n,x — n + 1, . . . ,n} either satisfies Y' = Np{f) or it can be split into two 
subsets Y( U Y2 = Y', where Y( = Np{f) and Y2 is the vertex set of one of the trees of F. In 
this situation, condition (ii) holds. Assume, next, that neither condition (i) nor condition (ii) 
hold. Then the parent Xq of / in T has at most one child in F, whereas / has no children. The 
latter implies that / is the rightmost vertex of the tree of F containing it. Since Xq 7^ /, we 
know that no more than two edges have been deleted from T, hence no large vertex other than 
/ can be a leaf of F. Consequently, condition (iii) holds, completing the proof. □ 

The above theorems lead to an algorithm that efficiently finds the fixed vertex of watermark 
G. The input is the forest F, obtained from the representative tree T of G by the removal of 
two edges. The algorithm is as follows: first, check whether / = 2n + 1. This is a direct task, 
applying Theorem HT) just verify if 2n + 1 is a leaf of F and whether all small vertices are 
children of 2n, except possibly two, which must be isolated vertices. If both conditions are 
satisfied then set / = 2n + 1 and terminate the algorithm. Otherwise, proceed to determining 
/, knowing that / < 2r;, + 1. Basically, it consists of checking conditions (i), (ii) and (iii) as 
described in Theorem |22j 

Procedure [2t Finding / 7^ 2n + 1 

input: forest F obtained from a damaged representative tree with 2 edges missing 
output: the fixed element / of the watermark 

1. If F contains a large vertex x having a sibling z 

then let / ■max{x, z} and terminate the algorithm. Otherwise, 

2. For each large vertex x of F satisfying Nf{x) ^ and each small y G Nf{x), 
let y = {,T - n, X - n + 1, . . . , n}. If N*p{x) = Y' or Np{x) C Y', 

and Y' \ Np{x) is the vertex set of one of the trees of F, 
then let / ^ x and terminate the algorithm. Otherwise, 

3. Find the preorder traversals of the three trees of F, and 

then let / be the unique vertex that is both large and the rightmost element 
of the preorder traversal of some tree of F. 



It is straightforward to conclude that Steps 1 and 3 can be computed in linear time. As for 
Step 2, observe that there are at most two large vertices x of F that may satisfy the condition of 
having only small children. Consequently, the tests in Step 2 apply to at most two candidates 
X, hence the entire algorithm runs in 0{n) time. 
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4.3 Determining the root's children 

After having identified the fixed vertex of the watermark, we are almost in a position to deter- 
mine the tree edges that have been removed. 

Observe that, when / = 2n + 1, the task is trivial, since, in this case, by Theorem [T9| there 
can be only one canonical reducible permutation graph G relative to n. Such graph is precisely 
the one with a type-1 representative tree T, which is unique for each n > 2 (cf. Property [3] 
of canonical reducible permutation graphs, in Section [2]). By definition, the root-free preorder 
traversal of a type-1 representative tree, when / = 2n+l, is n+1, n+2, . . . , 2n, 1, 2, . . . , n, 2n+l. 

We therefore want to determine the children of 2n+2 restricted to the case where / < 2?t,+1. 
Let G be a watermark, T its representative tree and F the forest obtained from T by the removal 
of two edges. As usual, / stands for the fixed vertex of T, X is the set of large vertices other 
than 2n + 2, and Xc = X \ {/}. Finally, denote by A C the subsets of ascending large cyclic 
vertices of T, which we shall refer to simply as the ascending vertices, and denote by D the set 
D = Xc \ A oi descending large cyclic vertices of T, or simply the descending vertices. Given 
the forest F and its fixed vertex /, the algorithm below computes the set A, which, as we recall 
from the proof of Theorem [19], corresponds precisely to the children of the root 2n + 2. 



Procedure [3t Constructing the set of ascending large vertices 


input 


: forest F obtained from a damage representative tree with 2 edges missing 


output: the set of children of the root 2?t, + 2 in the representative tree 


1. 


If F[Xc] U 2n 2 is connected then A ^ Npi^n + 2) 




and terminate the algorithm. Otherwise, 


2. 


If F[X^ U2n + 2 contains no isolated vertices then A ^ Npi^n + 2) U 2ra + 1 




and terminate the algorithm. Otherwise, 


3. 


If -F[Xc] U 2r2 + 2 contains two isolated vertices x, x' then A -h- Np[2n + 2) U {x, x'} 




and terminate the algorithm. Otherwise, 


4. 


If -F[Xc] U 2n + 2 contains a unique isolated vertex x then 




if |X*(/)| = 2n-/ + lthen 




let Ur be the rightmost vertex of Np{f) 




if \Np{2n + 2)\ < Vr then A ^ NF{2n + 2) U {x,2n + l} 




else A ^ NF{2n + 2) 




else A ^ NF{2n + 2) U {x} 



It is easy to conclude that the above algorithm can be implemented in 0{n) time. Below, 
we prove its correctness. 

Theorem 23 Procedure\^ correctly computes the set of ascending vertices A of T . 

Proof: We follow the different conditions that are checked by the algorithm. Assume F[Xc]U 
{2n+2} is connected. Then NT{2n+2) = NF{2n+2), implying A = NF{2n+2). The algorithm 
is therefore correct if it terminates at Step 1 . 
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Assume -^[^c] U {2n + 2} is disconnected, but has no isolated vertices. Then either 
Np{2n + 2) = Np{2n + 2) or the edge (2n + 2, 2?t, + 1) was one of those that might have 
been removed from T. In any of these situations, we can write A = Np{2n + 2) U 2n + 1, 
implying that the algorithm is also correct if it terminates at Step 2. 

Assume -^[Xc] U {2n + 2} contains two distinct isolated vertices x,x'. The only possibility 
is x,x' G NT{2n + 2). So, the action of constructing A as the union of x,x' and NF{2n + 2) 
assures correctness, whenever the algorithm terminates at Step 3. 

The last situation is -F[^c] U{2n + 2} containing a unique isolated vertex x. We consider the 
following alternatives. If \Np{f) \ = 2n — / + 1, it implies that N^{f) = Np{f), because the set 
of descendants of / in T comprises exactly . . . ,yn, The number of such descendants 

of / is therefore n — fo + 1, which, by Property [3] of canonical reducible permutation graphs, is 
equal to 2n — / + Now, by Theorem [T9| |A^T'(2n + 2)| = i/r, where i/r is the rightmost vertex of 
Np{f). In this situation, |A''^(2n + 2)| < Ur implies that x necessarily belongs to Np{2n + 2). In 
addition, edge {2n + 2, 2n + 1) might also have been deleted from T, since a single edge deletion 
suffices to turn x into an isolated vertex. Observe, on the other hand, that isolating a large 
vertex which is not a child of 2n + 2 requires the removal of at least two edges, provided n > 2. 
Thus, A = Np{2n + 2) U {x, 2n + 1}, and the algorithm is correct. In case \Np{2n + 2)| = 
we know that A^r(2n + 2) = A'"^(2n + 2), hence A = Np{2n + 2), ensuring the correctness of the 
algorithm. Finally, when \Np{f)\ 7^ 2n — / + 1, it means some edge inside the subtree rooted 
at / has been deleted from T. In this case, the isolated vertex x is necessarily a child of 2?t, + 2 
in T, implying A = Np{2n + 2) U {x}, and the algorithm is correct. □ 

4.4 Retrieving the missing edges 

Once we know the set of ascending vertices, it is simple to restore the entire tree T. Basically, 
given sets A and Xc, we obtain the set of D of descending vertices. Then, by sorting A 
and D accordingly, we can locate all the large cyclic vertices in T, using the model given by 
Theorem [191 We then place / in T, such that its parent Xq is smallest cyclic vertex that is 
larger than /. Finally, we place the small vertices. Vertices {1, 2, . . . , / — n — 1} are all children 
of Xn- The remaining small vertices {f — n, f — n + 1, . . . ,n} are descendants of / and their 
exact position in T can be obtained as follows. For each y E {f — n, f — n + 1, . . . ,n}, we find 
its position in the preorder traversal P of T by determining the large vertex x whose position 
in the bitonic sequence of the cyclic large vertices is exactly y. Then y must be the x— th vertex 
in the root-free preorder traversal of T. Finally, the position of / in P is clearly equal to /. 

The details are described in the algorithm below, which computes the preorder traversal P 
of T \ 2n + 2. 

Again, it is straightforward to conclude that Procedure S] correctly computes the preorder 
traversal of T in time 0{n). Such procedure assures the complete retrieval of T and therefore 
we are able to restore the watermark G in full. 

5 A new decoding algorithm 

We can now formulate our new decoding algorithm. If the input watermark presents k < 2 
missing edges, the algorithm is able to fix it prior to running the decoding step. The decoding 
step itself is absolutely straightforward, and relies on the following theorem. 
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Procedure 31 Retrieving the preorder traversal of a representative tree 

input: fixed vertex /, set A of ascending vertices, set of large cyclic vertices 
output: the preorder traversal P of T 

1. Let D ^Xc\A. 

2. The initial vertices of P are those of A in ascending order, followed by those 
of Z), in descending order. Subsequently, place in P the small vertices 

1, 2, ...,/ — -n, — 1, in this exact order, immediately after the last descending 
vertex Xn & D. Then place / as to immediately follow f — n — 1. 

3. For each small vertex y E {f — n, f — n + 1, . . . ,n}, let P[y] be the (large) 
vertex x whose index in P is y. Then place y in position x in P, i.e. so as 
to satisfy P[x] = y. 



Theorem 24 Let u be a given key and G the watermark corresponding to u. Let A' = 
Xi, . . . be the ascending sequence of children of 2n + 2, in the representative tree T of 

G, that are different from 2n + 1. Then 



Proof. The children of 2?7, + 2 in T are the vertices Xi of G which are the tail of some tree edge 
of G pointing to 2n + 2. From Property [8] of canonical reducible permutation graphs, such 
vertices Xi ^ 2n + 1 are precisely those satisfying Xi = n + Zi, where Zi is the index of a digit 
1 in the binary representation B of u. The summation yielding u can now be easily checked, 
since the relative value of a digit 1 placed at position Zi is 2"~^' = 2"~(^'"") = 2^"~^\ □ 

As a consequence of the above theorem, whenever the input watermark has not been tam- 
pered with, the proposed algorithm simply retrieves the encoded key in a faster, less complicated 
fashion than the original decoding algorithm from [3]jl 

Theorem 25 Algorithm retrieves the correct key, encoded in a watermark with up to two 
missing edges, in linear time. 

Proof: Since the final step of the algorithm clearly runs in linear time, its overall time 
complexity relies on the fact that Procedures 1-4 run in linear time themselves, as proved 
earlier in the text. The correctness of the algorithm follows from the fact that those procedures 
guarantee the reconstruction of the original watermark when k < 2 edges have been removed, 
and from the correctness of Theorem [2H □ 

Corollary 26 Distortive attacks in the form of k edge modifications (insertions/ deletions) 
against canonical reducible permutation graphs G, with \ V{G) \ = 2n + 3, n > 2, can be detected 
in polynomial time, if k <5, and also recovered from, if k <2. Such bounds are tight. 

^Note that, in this case, it is not even necessary to obtain the representative tree of the watermark, since 
the set A can be determined a.s A = N^{2n + 2). 




i=l 
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Algorithm O Obtaining the key from a possibly damaged watermark 

input: watermark G, with = 2n + 3 

output: the key uj encoded in G 

1. Let k ^ \E{G)\ - (4n + 3). 

2. \{ k > 2, report the occurrence of k edge removals and halt. 

3. If < /c < 2, proceed to the reconstitution of the watermark 
(Procedures 1-4, see Section Hj). 

4. Calculate and return the key u as indicated by Theorem [2^ 



From Theorem [251 know that, for n > 2, there are no two watermarks Gi,G2, with 
\V{Gi)\ = \V{G2)\ = 2n + 3, such that |^(Gi) \ E{G2)\ < 2, otherwise it would not always be 
possible to recover from the removal of up to two edges. Thus, for n > 2, any two canonical 
permutation graphs Gi,G2 satisfy 

\E{G,)\E{G2)\ = \E{G2)\E{G^)\>3, (1) 

hence Gi cannot be transformed into G2 by less than 6 edge modifications. Since the class of 
canonical permutation graphs can be recognized in polynomial-time in light of the characteri- 
zation given in Theorem [191 and since any number A; < 5 of edge modifications made to a graph 
G of the class produces a graph G' that does not belong to the class, all distortive attacks of 
such magnitude {k < 5) can be detected. Now, for k = 2, we have three possibilities: 

(i) two edges were removed; 

(ii) two edges were inserted; 

(iii) one edge was removed and one edge was inserted. 

If case (i) applies. Theorem [251 grants the original graph can be successfully restored. If case (ii) 
or case (iii) apply, then a simple algorithm in which all possible sets of two edge modifications 
are attempted against the damaged graph G' suffices to prove that the original graph G can 
be restored in polynomial time, since, as we already know, exactly one such set shall turn G' 
into a canonical reducible permutation graph. The case /c = 1 is simpler and can be tackled in 
analogous manner. 

It remains to show that such bounds are tight. We present a pair of canonical permutation 
graphs Gi,G2, with |\^(Gi)| = |l^(G'2)| = 2r;, + 3, > 2, such that inequation ([T|) holds with 
equality. We remark that there are many such pairs, and the following is but an example. Let 
Gi, G2 be the watermarks relative to keys Ui = 8, U2 = 9, respectively. Their edge sets are such 
that E{Gi) \ {(2, 3), (7, 8), (8, 9)} = ^(^2) \ {(2, 4), (7, 9), (8, 10)}, completing the proof. □ 

6 Computational results 

We started by implementing the encoding and decoding algorithms exactly as described in [3], 
as well as our new decoding algorithm given in Section \5l using the Python language. The 
source code can be found in http: //dec .ufrj ■br/~vigusmao/python/watermarking.py, , 
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Three distinct experiments were undertaken: 

• First, we generated the watermarks for all keys in the range [2^°, 2^^). We then decoded 
each watermark using both algorithms and compared the overall elapsed times. We then 
repeated the test for 10 thousand keys chosen uniformly at random in the range [2^°, 2^^]. 
By doubling the bitlenght of the watermarks that way, the linear-time behavior of both 
algorithms could be noticed, since the average decoding time was also clearly multiplied 
by 2. The average decoding times of both algorithms differed only marginally in favor of 
the new algorithm, which is by all means simpler when distortive attacks do not have to 
be dealt with. 

• Second, we removed all possible pairs of edges from the watermarks corresponding to 10 
thousand keys chosen uniformly in the range [2^*^,2^^], submitting such damaged water- 
marks to our decoding algorithm. The algorithm indeed succeeded in restoring the original 
canonical reducible permutation graphs — and therefore the original encoded keys — in all 
cases. The worsening in the average performance, as compared to that for non-damaged 
instances, was negligible. Indeed, the algorithm still performed marginally faster on 
damaged watermarks — when a whole step for detecting the attack and recovering the wa- 
termark was called for — than the former algorithm from [3] on non-damaged instances. 

• Finally, we defined ^'n{k) as the set of all keys ui of size n for which there exists a key 
UJ2 7^ wi of size n such that their respective watermarks Gi, G2 satisfy \E{Gi)\E{G2)\ < k. 
Then, for each n G [2, 16], we generated the watermarks G corresponding to every key u 
of size n, i.e. u G [2"~\2'^ — 1], and were able to construct the sets for n in the 
aforementioned range and k G [3, 5]. The keys belonging to IJn>2 ^n(^) ^^^^ ^'^ watermark 
instances which cannot always withstand distortive attacks in the form of k or more edge 
removals, since two such watermarks may become isomorphic after that sort of attack. 
The results we obtained indicate that, for a fixed k, the ratio of irrecoverable watermarks 
grows with n. 

7 Final considerations 

After characterizing the class of canonical reducible permutation graphs, we formulated a linear- 
time algorithm that restores a member of that class presenting two missing edges. The case 
where a single edge is missing is less demanding and can be solved by simpler algorithms. 
Our results therefore have proved that canonical reducible permutation graphs are always able 
to detect and recover from malicious attacks in the form of < 2 edge removal^ in linear 
time. Moreover, we have shown that attacks in the form of /c < 5 edge modifications (inser- 
tions/deletions) can be detected in polynomial time. 

Future directions. A necessary condition for a watermark Gi to recover from the removal 
of a subset of edges E[ C E{Gi), with \E[\ = k, is that G[ = Gi \ E[ is not isomorphic to 
some graph G2 obtained from watermark G2 7^ Gi by the removal of k edges. For < 2, we 

® The sole exceptions are two very small instances G, G' corresponding to keys of size n — 2, namely keys 
uj — 2 (binary B — 10) and uj' — 3 (binary B — 11), respectively, which become isomorphic when edges 
(1, 5), (4, 5) are removed from Gi and edges (1, 4), (4, 6) are removed from G2, as illustrated in Figure [HI 
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Figure 6: (a) The watermark Gi for key u = 2; (b) its representative tree Ti; (c) the damaged 
representative tree Tl obtained from Ti by removing edges (1, 5) and (4, 5); (d) the watermark 
G2 for key u = 3; (e) its representative tree T2; (f) the damaged representative tree T2 obtained 
from T2 by removing edges (1,4) and (4,6). Note that T[ and are isomorphic. 

have shown this condition is always satisfied, provided n > 2, and we have also exhibited an 
example — of plenty there are — in which the condition does not hold for k = 3. An interesting 
open problem is therefore to characterize the set of keys Q{k) whose corresponding watermarks 
can always recover from the removal oi k > 3 edges. 

Future research focusing on the development of watermarking schemes resilient to attacks 
of greater magnitude may consider extending the concept of canonical reducible permutation 
graphs by allowing permutations with /i-cycles, with /i > 2, as well as multiple fixed elements. 
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Appendix: proofs of the properties given in Section 



2 



Proof of Property [T]. When read from right to left, the n rightmost elements in Pf, corre- 
spond to the n first elements in Zi, i.e the n first indexes, in B* , where a digit 1 is located. 
Since B* starts with a sequence of n contiguous I's, the property ensues. □ 

Proof of Property [21. In i?*, digits with indexes 1, 2, . . . , are all 1, by construction. Since 
the n rightmost elements in Pb (i.e. elements indexed n + 2 < i < n* m Pb) correspond to the 
first n elements in Y, and therefore to the first n indexes of I's in B*, those will always be 
precisely the elements of set 5* = {1, 2, . . . , n}. In other words, if s G 5*, then s will have index 
n* — s + l>n + lin Pf,. By the time the elements of P^ are gathered together in pairs with 
views to defining their placement in Pg, element s will be paired with element q whose index 
is n* — (n* — s + 1) + 1 = s. Because s < n, such q clearly does not belong to S, hence q > n. 
Now, because s will be assigned index q in Pg, the element with index s in Pg will be its pair 
q > n, concluding the proof □ 

Proof of Property [31 The bitonic permutation Pf, is assembled in such a way that its 
(n + l)-th element / = 6„+i is either: 

(i) the {n + l)-th element of Zq, in case B* has at least n + 1 digits 0; or 

(ii) the {n + l)-th element of Zi, otherwise. 

By construction, the number of O's in B* is one unit greater than the number of I's in B. 

If (i) holds, then B corresponds to a key w that is the predecessor of a power of 2, implying 
all n digits of B are I's. If that is the case, then the desired property follows immediately, once 
the {n + l)-th element of Zq will be the index of the (n + l)-th — i.e. the last — digit in B*. 
Such index is, by construction, n*. 

If (ii) holds, then / is the index of the (n + l)-th digit 1 in B*. By construction, the n 
first digits 1 in B* occupy positions with indexes 1,. . . ,n, and the (n + l)-th digit 1 in B* 
corresponds to the first digit 1 in the one's complement of B. Since that digit has index /o 
in the one's complement of B, and there are in B* exactly n digits to the left of the one's 
complement of B, the property follows. □ 

Proof of Property (4]. From the construction of Pg and Property (H it follows that the 
elements that occupy positions with indexes 1, 2, . . . , n in are the first n elements in P^. It 
just occurs that the first rii + 1 numbers in Pb are the elements of Zq, i.e. the indexes of O's in 
B*. Now, the last digit in B* — the one indexed n* — is always a 0. Besides that 0, the other 
digits in B* have indexes z = n + d, where each d is the index of a digit 1 in P (the original 
binary representation of key w). While the first digit in B is always 1, it is also true that: 

(i) the /o — 1 first digits in B constitute a seamless sequence of I's, in case there is at least 
one in B; or 

(ii) all n digits of B are I's, in which case u is the predecessor of a power of 2. 

Whichever the case. Property [3] allows us to state that there is a sequence of / — n — 1 digits 1 in 
B starting at the first digit of P. Such sequence will show up, in P*, starting at index n + 1, in 
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such a way that the f — n — 1 first elements of Zq will he n + l,n + 2, . . . ,n + {f — n — 1) = / — 1. 
Those elements, as we have seen, will be precisely the first numbers in Ph. Because there are 
no more than n such elements, they will be paired against elements 1,2,...,/ — n — 1 < n 
(located from the right end of leftwards) in order to determine their placement in Pg, and 
the property follows. □ 

Proof of Property [5l If the key u is not the predecessor of a power of 2, then its binary 
representation B, whose first digit is always a 1, contains some digit 0. In light of this. Prop- 
erty |3] implies f > n + 2 for all integers u, and the first equality now follows from Property ID 
The second equality is granted by the self-invertibility of Pg, whereby Sj = u <^==^ Su = ]■ □ 

Proof of Property [61 First, note that f ^ n* e corresponds to the case where the key uj is 
not the predecessor of a power of 2, i.e. rii < n. Because the sequence Zq has exactly rii + 1 
elements, the last of which being the index n* of the rightmost digit in B*, element n* will 
always be assigned index rii + 1 in Pf,. As we have seen in the proof of Property IH for i < n, 
the i-th element in Pf, will also be the i-th element in P,, for it will be paired against element 
i, indexed n* — i + 1 in Pf, (due to the starting sequence of n digits 1 in B*). That being said, 
element n*, indexed ni + 1 < n in P^, will have index + 1 in P^ as well. If / = ra*, then the 
definition of / verifies the property trivially. □ 

Proof of Property [T]. We employ again the fact, noted for the first time in the proof of 
Property IH that the subsequence consisting of the first n elements in Pg and the subsequence 
consisting of the first n elements in Pb are one and the same. Since Pb is bitonic, whatever 
subsequence of Pb is bitonic too, particularly the one containing its first n elements. By Prop- 
erty |5l the central element s„+i of Pg is always equal to 1, therefore the bitonic property of the 
subsequence consisting of the leftmost elements of Pg will not be broken after its length has 
grown from n to n + 1, that is, after element s„+i = 1 has been appended to it. □ 

Proof of Property [51 The first rii + l elements of the bitonic permutation P^ are the elements 
of Zq, corresponding to the indexes of O's in the extended binary B* (which consists, we recall, 
of n digits 1, followed by the one's complement of the binary representation B of the key u 
encoded by G, followed by a single digit 0). Those elements constitute the ascending prefix 
A = n + Zi,n + Z2, . . . ,n + Zn-^,2n + 1, where, for z G {1, . . . , rii}, Zi is the index of a digit 1 
in B. From the proof of Property [U we know that, for i < n, the i-th element in Pb will also 
be the i-th element in the self- inverting permutation Pg. Since rii < n, we have that the ni 
first elements of Pg are precisely the ni first elements of A, hence the tree edge tailed at each 
of those elements must point, by construction, to 2n + 2. It remains to show that no element 
u ^ AU {2n + 1} is the tail of a tree edge pointing to 2n + 2. But this comes easily from 
the fact that, by Property [SI the {rii + l)-th element in Pg is 2n + 1. Since all vertices u with 
indexes i > ni + 1 in P^ are certainly smaller than 2n + 1, they can only be the tail of tree 
edges pointing to vertices q{u) < 2n + 1, and the proof is complete. □ 

Proof of Property [HI Both items are trivially verified, since, by construction, every tree 
edge {u, fc) G G is such that either k > u is the element that is closest to u and to the left of u 
in Pg, or k = 2n + 2. □ 
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